i used a lot of programs to clean my infected pc, seems like i had virtumonde, smitfraud-c and backdoor.bot
sysdrv32 was infected aswell
i ran adaware, comodo antivirus, malwarebytes,hijackthis, spybot s&d
now i think i cleaned it eventually.
i also removed internet explorer, because when i ran i.e, it makes me lol.exe problems, seems that svchost.exe is infected too.
this is my dds log
thank you for your help.
DDS (Ver_09-01-07.01) - NTFSx86
Run by matan asarut at 19:16:33.50 on Sat 01/17/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.511.203 [GMT 2:00]
AV: COMODO Antivirus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*
============== Running Processes ===============
C:\WINDOWS1\system32\Ati2evxx.exe
C:\WINDOWS1\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS1\System32\svchost.exe -k netsvcs
C:\WINDOWS1\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS1\system32\svchost.exe -k imgsvc
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Documents and Settings\matan asarut\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS1\system32\ctfmon.exe
C:\WINDOWS1\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\matan asarut\Desktop\dds.scr
============== Pseudo HJT Report ===============
mStart Page = hxxp://www.vmule.com/2008home.htm
uRun: [Google Update] "c:\documents and settings\matan asarut\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows1\system32\ctfmon.exe
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
dRun: [CTFMON.EXE] c:\windows1\system32\CTFMON.EXE
TCP: {C59C9677-C813-4787-A3AA-9B0E936F018A} = 194.90.1.5 212.143.212.143
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows1\system32\guard32.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\matana~1\applic~1\mozilla\firefox\profiles\z0ynljm5.default\
FF - plugin: c:\documents and settings\matan asarut\local settings\application data\google\update\1.2.133.33\npGoogleOneClick7.dll
============= SERVICES / DRIVERS ===============
R0 ssfs0bbc;ssfs0bbc;c:\windows1\system32\drivers\ssfs0bbc.sys [2008-11-12 29808]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows1\system32\drivers\cmdguard.sys [2009-1-14 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows1\system32\drivers\cmdhlp.sys [2009-1-14 31504]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R4 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2009-1-14 618232]
S4 servakrw;Shell Image;c:\windows1\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S4 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2008-11-12 3667312]
=============== Created Last 30 ================
2009-01-17 18:57 161,792 a------- c:\windows1\SWREG.exe
2009-01-17 18:57 98,816 a------- c:\windows1\sed.exe
2009-01-17 18:42 231 a------- c:\windows1\system32\spupdsvc.inf
2009-01-17 17:32 15,504 a------- c:\windows1\system32\drivers\mbam.sys
2009-01-17 17:31 38,496 a------- c:\windows1\system32\drivers\mbamswissarmy.sys
2009-01-17 17:31 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-17 16:48 1,351,392 a------- c:\windows1\system32\COMCTL32.OCX
2009-01-17 16:48 <DIR> --d----- c:\program files\XP TCPIP Repair
2009-01-17 16:41 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\_comodo_
2009-01-16 17:48 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Avg8
2009-01-16 12:23 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Webroot
2009-01-16 00:32 <DIR> --d----- C:\Binaries
2009-01-16 00:32 <DIR> --d----- c:\program files\Microsoft Windows OneCare Live
2009-01-16 00:31 <DIR> --d----- c:\program files\Webroot
2009-01-16 00:31 <DIR> --d----- c:\docume~1\matana~1\applic~1\Malwarebytes
2009-01-16 00:31 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
2009-01-14 22:17 147,192 a------- c:\windows1\system32\guard32.dll
2009-01-14 22:17 101,776 a------- c:\windows1\system32\drivers\cmdguard.sys
2009-01-14 22:17 31,504 a------- c:\windows1\system32\drivers\cmdhlp.sys
2009-01-14 22:17 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\comodo
2009-01-14 22:17 <DIR> --d----- c:\program files\COMODO
2009-01-14 20:02 <DIR> --d----- c:\program files\Trend Micro
2009-01-13 22:20 <DIR> --d----- c:\program files\Lavasoft
2009-01-13 19:46 <DIR> --d----- c:\windows1\SxsCaPendDel
2009-01-12 21:34 <DIR> --d----- C:\VundoFix Backups
2009-01-12 00:30 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-01-12 00:30 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Spybot - Search & Destroy
2009-01-10 21:19 1,406 a------- c:\windows1\system32\NV.ico
2009-01-10 20:12 0 a---h--- c:\windows1\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-01-10 20:12 0 a---h--- c:\windows1\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-01-10 20:11 79,376 a------- c:\windows1\system32\drivers\LMouKE.Sys
2009-01-10 20:11 63,248 a------- c:\windows1\system32\drivers\L8042mou.Sys
2009-01-10 20:11 36,112 a------- c:\windows1\system32\drivers\LMouFilt.Sys
2009-01-10 20:11 34,832 a------- c:\windows1\system32\drivers\LHidFilt.Sys
2009-01-10 20:11 20,496 a------- c:\windows1\system32\drivers\L8042Kbd.sys
2008-12-20 16:11 <DIR> --d----- c:\windows1\RegisteredPackages
==================== Find3M ====================
2008-12-19 17:08 180,828 a------- c:\windows1\pchealth\helpctr\config\cache\Professional_32_1037.dat
2008-04-14 02:11 162,218 a--shr-- c:\windows1\system32\iokvbjdd.dll
============= FINISH: 19:17:14.60 ===============
thanks again for your time and help.